Allow file uploads for non-registered users

Question

I am creating a service that allows my website visitors to create content (text) and save it so they can access it at a later time. However, users don't need a user account before they can use this feature. They just click "Try now" and use it. If they want to save their work, then that's the time they need to sign up.

I am planning to add Uploading of images/files as a feature. However, I'm at a loss for ideas on how to implement this for the "Try now" mode (non-logged in user). On top of my head, I would create a temporary username and store it in a session, and create a corresponding temporary folder where the user's uploads go to. But, how do I clean it up? The user can just close the browser, and I will have no way of knowing the temporary folders are still being used.

Is there a better way of doing this? Or should I just prevent uploading of files for non-registered users altogether?

I'm using PHP on CodeIgniter by the way.

Your input would be invaluable :) Thanks!

Answer 1

You probably already have some kind of session key for your user, use that as the temporary directory name. Delete the directory when the user's session times out, that is, they haven't been active for a long time. For anonymous users, "a long time" could be as little as a few days. This can be done by a separate cleanup process if it's hard to hook to the session timeout.

You'll probably also want to limit the amount of disk space anonymous users can use, just in case.

Answer 2

Here one of possible ways to do:

• On each page request, save the session ID - datetime pair in the database,
• For every saved image, save the file and the associated session ID in the database.

Then, you can regularly check for obsolete files. For example, if your session limit is 30 minutes, you can walk through the database and select every expired session, ie. the records where the datetime + 30 minutes is less than now. Then, remove every file stored through those expired sessions.

Answer 3

So, if you put them inside of folder, give them some kind of temporary name, like _tempimage_<username>, whenever this uploading script is called, scan for those temp files and if they are found, but not used, delete them. To check if they're used, use database to store those "try now" entries for some amount of time.

Simple and easy way I think.